Are questions that involve SSI on-topic?

Question

There have been a few questions that are answerable but to do so would invoke Sensitive Security Information. While some SSI has made its way into public knowledge and someone determined to know these things probably can, should we allow these questions (and the potential of someone answering them) on this site?

A current example is this question which asks if it is possible to bluff your way onto an airline jumpseat. Given inside knowledge of procedures and what a flight crew would expect from a jumpseater, someone could probably pull this off, but I don't think this type of knowledge is appropriate for this site. Right now this question has some close votes for "opinion based", and I added a VTC for off-topic, as that is my opinion of this type of question. What do you think?

Is a question that can only be answered by invoking SSI on-topic?

Answer 1

I totally agree with Lnafziger that if there are portions which can be answered using knowledge the general public already has access to, then do so. I also think that it's perfectly fine to leave a comment (like you did), or append to your answer, stating that revealing specifics of how security is implemented would be a breach of confidentiality or even illegal. This is still useful information to the person who asked the question because they may be unaware of the classified nature of certain security protocol.

Of course, if you are ultimately uncomfortable with leaving an answer of any kind because you're concerned the contents would put you in legal or professional jeopardy, then everyone will respect that decision.

On a separate note, I'm not sure whether I agree with you that it's off-topic since it's related to pilot operations/procedures . It's certainly a grey area. The other close votes are for primarily opinion-based, which also might not be entirely accurate. However, my instinct is to close it because I think it isn't likely to attract a good answer, and is likely end up with low-quality opinion-based answers. I'll let the community decide though.

Answer 2

I certainly did not mean to set off a storm of criticism here, the original question was purely out of curiosity.

The problem as I see it that we live in very different localities. Naturally, the United States is very security conscious, while even here in Europe there's more than one jurisdiction and airline where you can from a legal standpoint jumpseat as a passenger in large commercial aircraft by little more than walking in and introducing yourself and asking.

I think that as the site may grow, people with other security habits will come in and answer these, so it becomes a complicated job to censor it. That leads to the problem that what you might define as SSI is not what somebody else defines as SSI, and they might answer it. It might be best to introduce an complete ban of questions of a certain nature on this site, assuming that is possible on Stack Exchange.

Answer 3

I would consider these kinds of questions on-topic (because they are related to aviation - specifically aviation security procedures), though possibly "not answerable" (because answering them would require revealing sensitive information).

Where possible we should try to give broad answers without disclosing sensitive information e.g.:

A lot has changed since the Frank Abagnale / "Catch Me If You Can" days, and riding as a non-revenue passenger (particularly in the jump seat) is no longer not as simple as grabbing a passable captain's uniform, polishing your shoes up, and smooth-talking the flight crew.
Someone seeking a ride in an airplane jump seat would still have to pass through airport security and prove their identity & authorization to occupy such a seat to the satisfaction of the crew operating the flight, which would likely include checking credentials that are at lease somewhat difficult to forge.

So in short it's possible – someone particularly adept at social engineering and forgery might get away with it – but it's extremely unlikely these days.

Answer 4

I personally think this kind of problem is best dealt with by cultural moray (aka, etiquette, social norms, etc.). If the general habit here is to make a comment that says, "that information is pretty sensitive, I don't know if this information should be in the public domain" then people will not ask questions they find, err, questionable.

The nice thing about a cultural moray (as opposed to a hard and fast rule) is that it's far more negotiable and allows for the debate of border cases (a healthy thing, in my opinion, so long as we remain civil.) Where as a hard and fast rule is often used as an overbearing justification to restrict anything that appears to go against the rule. A problem that is heightened, in this case, by concerns for public security.

In summary, I don't think we should have an actual rule about restricting question types. But I would encourage anyone who has concerns about the types of questions being asked to make a note of it on the question in, um, question...

Answer 5

Well, I think that the question can be answered without giving the actual knowledge needed to do it since it didn't ask "how" to do it Same can be said for most SSI questions. Anything covered by a non-disclosure agreement (like some of the TSA security programs) can obviously not be disclosed, but general questions can often be answered without disclosing the SSI.

Answer 6

Many years ago I followed a newsgroup (remember those?) that dealt with military matters, especially aviation. One of the more prominent posters one day put up a notice saying she'd just completed classified weapons training on the F-??? aircraft. Since her mind was now "polluted" (her term) with classified weapons info, she formally recused herself from any further discussions on the topic.

She didn't want to get too close to that "is this classified or not" question, with good reason.

That's the approach I'd take. If I could answer a question because of some Security Sensitive Information, I'd elect not to answer. I might make an exception if I could back everything up with references to public sources. Maybe.

Answer 7

When designing a secure system, one thing you can safely assume is that your adversaries are well aware of all of your procedures. If you are under legal/contractual/professional obligation to keep a certain information under wraps (or even if you're just generally uncomfortable with it), then please keep doing so, since it brings nothing good to you to disclose an information deemed a secret.

However, keeping anyone else from sharing information about a security system does nothing to improve the security of the system. If the only thing preventing anyone from breaking a system is just because the security procedures is deemed a secret, then disclosure of that information would have been a great public service, so as to push whoever responsible to fix any broken procedures immediately. Security by obscurity is no security at all.

Keeping security procedures a secret have little value in security, one thing you can be sure of is that any serious hijackers have done their homework. It is especially silly to consider a regular procedures known by thousands of airline workers as a "secret" in the first place.